Description of problem: With mgmt-gateway enabled, the internal URLs for prometheus or alertmanager are accessible when entered manually. This is a security breach as only the external URLs must be accessible with mgmt-gateway enabled. Version-Release number of selected component (if applicable): 19.2.0-12.el9cp How reproducible: 1/1 Steps to Reproduce: 1. Deploy a ceph 8.0 cluster 2. Deploy mgmt-gateway service using below command # ceph orch apply mgmt-gateway 3. Access the dashboard using the ip address (without port number) 4. Access the external URL for prometheus/alertmanager eg. https://<ip>/prometheus/graph?g0.expr=&g0.tab=1&g0.stacked=0&g0.show_exemplars=0&g0.range_input=1h 5. Edit the URL to make it the internal URL eg. https://<ip>:29443/internal/prometheus/graph?g0.expr=&g0.tab=1&g0.stacked=0&g0.show_exemplars=0&g0.range_input=1h Actual results: Internal URl is accessible Expected results: Internal URL must not be accessible Additional info:
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Red Hat Ceph Storage 8.0 security, bug fix, and enhancement updates), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2024:10216